- Identify the 3 different "legs" of OAuth
- Use an external API to provide user authentication on an app
- Explain the difference between a session variable and an environment variable
- Request token
- Consumer key
- Consumer secret
- User token
- User secret
- Callback URL
- Querystring
- Authorize
- Authenticate
Most "Log in with X" buttons you see use OAuth. We'll be looking at "Log in with Twitter" today.
OAuth is a set of standards; not software. Developers have agreed that this set of standards is a good way to securely authenticate users.
In short: your app asks Twitter to log in your user, and if they're successful, Twitter sends your app a special "token" that's unique to that user.
You can stop there and use this as a way of logging people in and out.
You can also take this a step further as a way of letting users authorize your app to talk to Twitter's API on their behalf. Using that token, your app can get additional information about the user, make posts for them and so on.
- What's the difference between authenticating and authorizing?
There are several versions and types of OAuth. We'll be using "three-legged" OAuth.
Folllow the link below, click "Create New App", and follow the steps.
- The Name, Description, and Website are unimportant. Use whatever you want.
- The Callback URL should be
http://127.0.0.1:3001/login/twitter/callback
.127.0.0.1:3001
is an alias forlocalhost:3001
. External APIs often don't like to work withlocalhost
, but accept127.0.0.1
just fine.3001
andlogin/twitter/callback
are just what is used in the walkthrough. You could use any port number and path.
- Click on the "Keys and Access Tokens" tab and copy down the "Consumer Key" and "Consumer Secret"
git clone git@github.com:ga-wdi-exercises/whenpresident.git
cd whenpresident
git checkout 88a8de4
git checkout -b twitter-starter
This uses WhenPresident.
- Passport, an NPM package for OAuth with over 300 APIs
- OAuth Bible
- Request Talking to Twitter, from Request's own Github page
- Coinbase's API, on which Robin used to work
- Screencasts